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1.12 (not yet released) 

• Wrote razord-sync(l) and razord-alive(l). razord-sync rsyncs 
the catalogue at bootup and bootstrap, razord-alive broadcasts 
an " I am alive" message to all servers in the razor-echo zone 
at bootup. 

• Wrote Razor: :Config::findconf() and Razor: :Config::findbin() to 
locate Razor config files and binaries on the system. By default, 
razord (i) is setup to run from $ENV{HOME}. 

• Razor's various distributed functions are now split accross 4 
zones, razor.vipul.net lists the servers that contain an up-to- 
date copy of the catalogue, razor-check (l) picks up the closest 
server from this zone to check incoming mail, razor- 
report, vipul.net lists the servers that accept spam reports for 
the razor.vipul.net zone, razor-report(l) will send reports to 
the closest server from this zone. Servers in this zone will echo 
reports to all catalogue servers listed in the razor- 
echo. vipul.net zone. Finally, razor-rsync.vipul.net lists servers 
that provide rsync access to their catalogues for other 
catalogues to sync with. 

• Added * noecho' and % norecordchecks' parameters to 
razord. conf. 

• Added "bind" and "group' parameters to razord. conf and made 
them mandatory. 

• Introduced ECHO protocol. Reports are echoed to other razor 
servers in the zone. Incoming reports are batched and 
broadcasted by razord-echo. 

• Several minor fixes. 

• Razor: Signature reorganized. Moved hasho to "String and 
renamed "Signature to more appropriate, "Catalogue, razor- 
agents package doesn't require Net:: Daemon and 
Persistence: :Object: :Simple anymore. 

• razord can lookup multiple catalogues mounted at different 
places on the filesystem. 
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• razord heals corrupted objects. 

• Added closest host discovery to Razor: iClient. See razor- 
agents/Changes for details. 

• Added support for reading config options from /etc/ razord. conf 
(server configuration) and -/razor.conf (client configuration). 
Moved config code to Razor: :Config 

• Added protocol version to razord greeting 

0.24 (first version of pretty good release, may 22, 
2000) 

• First public release. 

0.20 (first version of peer review release, may 19, 
1999) 

• First peer- review release. 
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What is Vipul's Razor? 

Vipul's Razor is a distributed, collaborative, spam detection and 
filtering network. Razor establishes a distributed and constantly 
updating catalogue of spam in propagation. This catalogue is used by 
clients to filter out known spam. On receiving a spam, a Razor 
Reporting Agent (run by an end-user or a troll box) calculates and 
submits a 20-character unique identification of the spam (a SHA 
Digest) to its closest Razor Catalogue Server. The Catalogue Server 
echos this signature to other trusted servers after storing it in its 
database. Prior to manual processing or transport-level reception, 
Razor Filtering Agents (end-users and MTAs) check their incoming 
mail against a Catalogue Server and filter out or deny transport in 
case of a signature match. Catalogued spam, once identified and 
reported by a Reporting Agent, can be blocked out by the rest of the 
Filtering Agents on the network. 

What should I download? 

Fetch the latest versions of razor-a g ents and razor-a g ents-sdk 
packages. The SDK bundles all Perl modules required by razor-agents 
and should be installed before razor-agents. Required modules 
( Net::Ping , Net::DNS . Time::HiRes , Digest::SHA1 and Mail::lnternet ) 
are also available from CPAN. 

How do I install razor-agents? 

Both razor-agents and razor-agents-sdk are installed in the standard 
perl way: perl Makefile. PL; make; make test; su; make install. Once 
razor-agents is installed see manpages of r azor- c heck and razo r- 
re port for instructions on hooking them up in your mail stream. 

What has changed since last release? 

The current release of Vipul's Razor is Release 1. Release 1 adds 
distributed functionality and fixes some long pending issues. For more 
information on changes see the change logs for razor-agents and 
razord . If you are still running razor agents from the pretty good 
release (0.24), you are strongly advised to upgrade. 

Where is Razor developed? 

Vipul's Razor is developed and hosted on sourceforge. Here's the 
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sourceforge project summary. It's a good idea to join the either of the 
razor-users or razor-announce mailing lists if you are going to run 
razor actively. 



Where's all the documentation? 



The following manpages are bundled in the razor-agents package, 
and also available online: razor-checkd ). razor-report(l) . razor- 
discoyer(l), razor.conf(5 ). Razor: :Client(3) 

Also see the razor-users mailing list archive for operational details and 
future development plans. 

How can I help? 

Razor's efficacy is proportional to the number of people using it. That 
is, more spam reports translate into fewer spams in your mailbox. If 
you are a Razor user, please ask your peers to use it too. If you are an 
ISP, you can setup a troll address (see razor-re port manpage) where 
your users can bounce the spam they recieve, and integrate razor into 
your webmail system. If you are developer, you can help by 
contributing instructions and code to hookup razor agents with mail 
systems of your choice. And, finally, you can help by contributing code 
(see the task list for what remains to be done). 



License 



Copyright © 1999-2001 , Vipul Ved Prakash . This software is 
distributed under the Artistic License (see the ARTISTIC file). 
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Synopsis 

razor-check [-s -d -H] f ile_with_mail_in_rf c822_f ormat 

$ cat mail | razor-check 
$ razor-check ./mail 
$ razor-check -d ./mail 

Description 

razor-check checks a mail against the distributed Razor Catalogue. It 
should be invoked before the mail is delivered or processed by a 
human, razor-check terminates with exit value o if the signature for 
the mail is catalogued on the server (spam) or 1 if the mail is not 
catalogued by the server (not a spam), razor-check should be invoked 
against every incoming mail by mail processors (like procmail) or MTAs 
(like sendmail). An alternate method would be to call razor-check 
from cron, at regular intervals, to identify and mark spam in queued 
mailboxes. 



razor-check is usually run by piping the contents of the mail to it, or 
by providing the name of the file that contains the mail message to be 
checked as the last argument, razor-check takes the following 
arguments: 



Simulate a check. Do everything except talk to the server, 
-d | -verbose 

Print debugging information. 



Compute and print the SHA hash of the mail contents. And then 



Usage 



s 



exit. 



-M | 



-mbox 
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Accept a mailbox name on the command line and check every 
mail in the mailbox against the database, razor-check will print 
out the serial number of every mail found in the Catalogue. 
When combined with -n it will also print the serial numbers, 
prefixed with a -, of mails that were not found in the Catalogue. 
Usage: 

razor-check -M -/Mail/possible-spam 

-S I -sig 

Accept a list of pre-computed (with -h) signatures on the 
command line, instead of computing one from mail content. 
When called with --sig, razor-check will not attempt to read 
from STDIN. Usage: 

razor-check -d -S a8a3d545adb73f 9733675571f f eaf 10cba87745b 

-conf=filename 

The path of the config file. By default the path is -/razor.conf, 
an alternate path can be specified with this option. See 
razor. conf (5) manpage for various configuration options. 



-h 



-v 



Print a usage message and exit. 



Print the version number and exit. 
Recipes 

razor-check is usually invoked from procmaii (i) . Here are some 
common ways of using it with procmaii: 

To change the Subject header if mail is spam: 

:0 Wc 

| razor-check 

:0 Waf 

| formail -i "Subject: Razor Warning: SPAM/UBE/UCE" 

To add a X-Razor-Warning header to spam: 

:0 WC 

| razor-check 
:0 Waf 
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| formail -A "X-Razor-Warning : SPAM." 

To file spam in a mailbox 

:0 WC 

| razor-check 
:0 Wa 

/home/ f oo/Mail/razor- caught 

Author 

Vipul Ved Prakash, < mail@ vi puLnet > 
See also 

razor. conf (5) ? razor- report (1), razor-discover (l) 
License 

This is free software, distributed under the ARTIST IC license. 

Generated on Tue Dec 4 07:02:41 2001 

raxoiJiQrn_ep_age 



http://razor.sourceforge.net/razor-check.html 



12/7/2001 



Changes - razor-agent 



Changes - razor-agent 



1.17 (december 01, 2001) 

• Removed the * * Persistence: :Object::Simple" dependency from test.pl 
1.16 (november 27, 2001) 

• Applied Nick Mossie's patch to fix --mbox option in Razor:: Agents. 

• Added support for split zones in Razor: :Config::new(). Razor zone is now split into 
subzones, 'report and 'check' to control the latency of report propagation through 
distributed servers. Servers listed in the reports zone accept checks and those in the 
check zone accept check request. It is important that users upgrade to this versioi 
otherwise their reports might be lost (as they will go to the nearest check servers, 
instead of a report server). 

1.13 (november 13, 2001) 

• Razor: :Client/ Agent don't exit o or die o ; they cascade the error back to the caller 
through Razor: :Errorhandler::errstr() 

1.12 (november 7, 2001) 

• Razor::Client returns exit values >1 for different errors. These are described in 
Razor: :Client (5) manpage. 

• Razor agents now use Getopt::Long instead of -s, to keep older versions of procmail 
happy. All old options are valid and retain their meaning. 

• Moved command line parsing and common routines from razor-check/ report to 
Razor:: Agents. 

• razor-check and razor-report can now work on mailboxes. A mailbox (in mbox forma 
can be provided on the command line with the - -mbox option, razor-check/ report w 
print the serial numbers of mails that were found in the catalogue. 

• --sig option takes multiple signatures on the command line. 

• All required modules are now bundled in razor-agents-sdk. Released version 1.00 of 
SDK. 

• All modules use strict. 
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• Added support for checking and reporting precomputed signatures to razor-check an 
razor-report, through the -sig option. 

• Added support for -h in razor-report. 

• Razor: Signature reoraganized. Moved hasho to ::String and renamed : Signature to 
more appropriate, :: Catalogue, razor-agents package doesn't require Net:: Daemon a 
Persistence: :Object: :Simple anymore. 

• Fixed a hairy bug in Razor: :Client; it was too hairy to describe here. 
1.06 (October 20, 2001) 

• razor-check & razor-report now return correct exit values. 

• Some small fixes to POD documentation. 
1.05 (October 19, 2001) 

• 1.04 was broken. 

1.04 (first version of release 1, October 18, 2001) 

• Added closest host discovery to Razor: :Client. Here's how it works: All razor servers 
that belong in a * "zone" (razor.vipul.net, by default) are named a. zone, b.zone, etc 
The client does a nslookup on a. zone, then b.zone and so on till it finds a domain th 
has a CNAME * "list. terminator". Client sends out TCP pings to echo ports of these he 
and computes round trip time using Time::HiRes. The list of available servers is sort 
based on RTTs and the closest server is chosen. 

Rediscovery happens after rediscovery_wait amount of seconds, which is 7 (+-1) day 
by default. It can be forced with <razor-client -d> command. 

Client moves from closest host to the next closest host, if: 

- The server is not responding. 

- The server has been upgraded and client doesn't understand the new protoc 

- The server is broken, gives spurious answers. 

The next closest host remains the chosen host till rediscovery. This takes care of 
server/ network outages, semantically broken servers, and transition from old to nev 
protocols. Thanks to Peter J. Holzer for suggesting the use of a host naming scheme 
server discovery. 

• A fix to Razor: Signature to workaround procmail munging of mail. Thanks to Nick 
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Mossie for pointing this one out and suggesting a solution 

• Added a debug mode to Razor: :Client 

• Moved client API to Razor: :Client 

• Added support for reading config options from /etc/razord.conf (server configuratio 
and -/razor. conf (client configuration). Moved config code to Razor::Config 

0.24 (first version of pretty good release, may 22, 2000) 

• First public release. 

0.20 (first version of peer review release, may 19, 1999) 

• First peer- review release. 
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• Operating System: POSIX 
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